diff options
| author | Milan Broz <mbroz@redhat.com> | 2011-03-24 13:54:30 +0000 |
|---|---|---|
| committer | Alasdair G Kergon <agk@redhat.com> | 2011-03-24 13:54:30 +0000 |
| commit | f868120549fc1664b2c451d4b9882a363928c698 (patch) | |
| tree | 20d95a8f3b9fac1348bd42a5ff1e3f9d43918b93 /include | |
| parent | 6bb43b5d1f54fb44c0408d86d5e71e4405a3ebe1 (diff) | |
| download | kernel_samsung_smdk4412-f868120549fc1664b2c451d4b9882a363928c698.zip kernel_samsung_smdk4412-f868120549fc1664b2c451d4b9882a363928c698.tar.gz kernel_samsung_smdk4412-f868120549fc1664b2c451d4b9882a363928c698.tar.bz2 | |
dm ioctl: add flag to wipe buffers for secure data
Add DM_SECURE_DATA_FLAG which userspace can use to ensure
that all buffers allocated for dm-ioctl are wiped
immediately after use.
The user buffer is wiped as well (we do not want to keep
and return sensitive data back to userspace if the flag is set).
Wiping is useful for cryptsetup to ensure that the key
is present in memory only in defined places and only
for the time needed.
(For crypt, key can be present in table during load or table
status, wait and message commands).
Signed-off-by: Milan Broz <mbroz@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
Diffstat (limited to 'include')
| -rw-r--r-- | include/linux/dm-ioctl.h | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/include/linux/dm-ioctl.h b/include/linux/dm-ioctl.h index 78bbf47..3708455 100644 --- a/include/linux/dm-ioctl.h +++ b/include/linux/dm-ioctl.h @@ -267,9 +267,9 @@ enum { #define DM_DEV_SET_GEOMETRY _IOWR(DM_IOCTL, DM_DEV_SET_GEOMETRY_CMD, struct dm_ioctl) #define DM_VERSION_MAJOR 4 -#define DM_VERSION_MINOR 19 -#define DM_VERSION_PATCHLEVEL 1 -#define DM_VERSION_EXTRA "-ioctl (2011-01-07)" +#define DM_VERSION_MINOR 20 +#define DM_VERSION_PATCHLEVEL 0 +#define DM_VERSION_EXTRA "-ioctl (2011-02-02)" /* Status bits */ #define DM_READONLY_FLAG (1 << 0) /* In/Out */ @@ -328,4 +328,10 @@ enum { */ #define DM_UUID_FLAG (1 << 14) /* In */ +/* + * If set, all buffers are wiped after use. Use when sending + * or requesting sensitive data such as an encryption key. + */ +#define DM_SECURE_DATA_FLAG (1 << 15) /* In */ + #endif /* _LINUX_DM_IOCTL_H */ |